Why it matters
A Content Security Policy is an allow-list for scripts. Without one, a single injected script can read everything your visitors type.
How to check it yourself
In DevTools, Network tab, click the page request and look for content-security-policy in the Response Headers. No header, and no CSP meta tag in the page source, means any script that gets onto your page is allowed to run.
What the fix involves
Add a Content-Security-Policy response header that allows your own domain plus the specific analytics, font and payment domains you really use, and blocks the rest. Start in report-only mode if you're nervous, then enforce it.
Reference: developer.mozilla.org
How vibeliq checks it
We load your page the way a visitor's browser would, read what your server sends back, and look at a short list of well-known addresses on your site. If this turns up, your report explains it in plain English and gives you a prompt, written for Claude Code, Cursor, Lovable or whatever built your site, that fixes it in your actual codebase.